Important security fixes. security advisory Update Winstone to version 8.1047.x with Eclipse Jetty 12.1.12. pull 27193 Important security fixes. security advisory Avoid null pointer exception showing the upstream cause of a job that was triggered by the build step in a pipeline prior to a Jenkins restart (regression in 2.558). issue 26633 , pull 27094 Fix weird animation artifact when clicking "Apply". issue 16570 , pull 27002 Fix build history tooltip being clipped by overflow hidden. issue 27000 , pull 26554 Install Jenkins controller via the MSI available via the "Windows" links on https://www.jenkins.io/download/ Build their own image Update Spring Security from 7.0.5 to 7.1.0. Spring Security 7.1.0 release notes , Spring Security 7.0.6 release notes , pull 26904 Update Spring Framework from 7.0.7 to 7.0.8. Spring Framework 7.0.8 release notes , pull 26896 Update bundled Script Security Plugin from 1402.v94c9ce464861 to 1402.1405.vc96e74964250. pull 26989 Disable sticky elements when the disableStickyPositioning HTTP cookie is enabled (used in acceptance tests). pull 26883 Re-enable the "Add" button immediately when an item is deleted from a full list (regression in 2.536). pull 26937 Fix blue tinted scrollbar. pull 26893 Fix the combobox suggestion list flashing and closing immediately when the field is clicked. pull 26884 Use a dialog to add and edit the description of jobs, builds, views, computers, and more. pull 26535 Refine appearance of dialogs. pull 26514 Refine the 'System' page of Manage Jenkins. pull 26679 Refine the 'Users' page of Manage Jenkins. pull 26475 Refine how administrative monitors are displayed. pull 26417 Deduplicate build causes in queue tooltip and build overview. pull 26392 Reduce agent creation time during high usage. issue 26796 , pull 26797 Improve queue maintenance performance for jobs with large build histories. pull 26597 Add Windows Server 2025 container image for the Jenkins controller. pull 2369 Ensure cancel button for queued jobs doesn't move when other badges are present. pull 26564 Remove lines from log recorder page. pull 26598 Wrap long, unbroken strings correctly within the maximum width of the dialog. pull 26574 Restore the job name in the page title on the build console and changes pages. pull 26727 Ensure urls in widgets loaded via ajax are correct. pull 26721 Important security fixes. security advisory Prevent active builds from being lost when a job is reloaded (regression in 2.523). pull 26700 Limit the SECURITY-3657 security fix by default to the controller JVM due to reported problems extracting some stashes involving symbolic links on agents. pull 26709 Ensure applying configuration as code retains the offline cause of agent (regression in 2.482). pull 26749 Fix race condition in plugin manager search results. pull 26819 Update dependency lodash to v4.18.1. pull 26578 Keep the Duplicate Jenkins checker enabled when saving the global configuration (regression in 2.549). issue 26285 , pull 26631 Update Winstone to version 8.1039.x with Eclipse Jetty 12.1.8. pull 26757 , Jetty 12.1.7 changelog , Jetty 12.1.8 changelog , Winstone 8.1039.x changelog , Winstone 8.1034.x changelog Update bundled Script Security Plugin from 1399.ve6a_66547f6e1 to 1402.v94c9ce464861. issue 26720 , pull 26719 Update bundled Matrix Authorization Strategy Plugin from 3.2.9 to 3.2.10. issue 26720 , pull 26719 Upgrade Spring Framework from 6.2.16 to 6.2.17. Upgrade Spring Security from 6.5.8 to 6.5.9. Spring Framework 6.2.17 release notes , Spring Security 6.5.9 announcement , pull 26556 Fix multibranch Pipeline scan from parent folder (regression in 2.547). issue 26516 Require Java 21 or newer. pull 26018 Remove Java 17 container images for the Jenkins controller. pull 2179 (Docker) Enables the Overall/Manage permission by default. This permission when granted to users allows them to configure certain parts of Jenkins' global configuration without the ability to execute arbitrary code. pull 23873 API tokens with expiration date. pull 23859 Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths. pull 23915 No longer include the client IP address in CSRF protection token ("crumb") calculation. Effectively, the behavior is the same as if the (now removed) "Enable proxy compatibility" option were always checked. pull 25918 Show a warning to administrators who set the hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID flag, informing them of the further reduced safety, and the option's planned future removal. pull 25918 Bump the minimum supported remoting.jar version to 3176.v207ec082a_8c0 . pull 26034 Revamp Clouds page. pull 26315 Fix sidebar navigation for non-ASCII localized section headers. pull 26068 Fix a 404 error when clicking plugin names on the “License and dependency information for plugins” page. pull 26029 Fix primary button text color in administrative monitors. pull 26212 Fix progressive rendering progress calculation. pull 26235 Redirect to the correct URL when creating log recorders with non-ASCII names. JENKINS-26318 Do not fail builds when the tool installation directory is readonly. JENKINS-16005 Important security fixes. security advisory Clarify UI label when configuring Content Security Policy. issue 26197 Do not compute the CSP header if it's completely disabled using the Java system property jenkins.security.csp.CspHeader.headerName in case computation takes too long. issue 26254 Fix exception message being logged in rare cases on views with keyboard shortcut indicators. issue 26213 Make redirects to documentation on www.jenkins.io work in the builtin administrative monitors when using Chrome and enforcing Content Security Policy. issue 26001 Important security fixes. security advisory Submitting a form would in rare cases, lead to an error ( Got type array but no lister class found for type... ) JENKINS-76249 Fix temporary offline state of computer is lost on config submit issue 26146 Add telemetry for Java properties. pull 26038 Update Winstone to version 8.1026.v31def012a_f48 to increase the default maximum HTTP response header size to 32KB to account for very complex Content Security Policy headers. pull 25901 Allow entirely disabling CSP headers to work around unusual Jenkins configurations resulting in excessive HTTP response header lengths. pull 23915 Add telemetry for Content Security Policy enforcement. pull 23901 Add Windows Server 2022 for Windows controller and agent containers. pull 2209 (Docker) , pull 441 (Docker agents) Add Java 25 container images for the Jenkins controller and agents. pull 2146 (Docker) , pull 549 (Docker SSH agent) , pull 1061 (Docker agents) Use rootURL in Cloud sidepanel so links in actions work properly. pull 26004 Fix console log copy button for freestyle projects that have finished (regression in 2.493). pull 25953 Allow large forms to be submitted (regression in 2.531). pull 25968 Support Java 25. pull 11148 Allow configuring Content-Security-Policy protection for the Jenkins UI. Introduce an API for plugins to relax (or further tighten) the rules around various resources. If you have the Content Security Policy Plugin ( csp ) installed, update it to version 2.x. admin documentation , plugin compatibility , developer documentation , JENKINS-76263 Red Hat and openSUSE packages are unified into the same RPM packaging with a brand new URL: https://pkg.jenkins.io/rpm-stable/ . We kept the former LTS packages (versions 2.528.3 and below) in https://pkg.jenkins.io/redhat-stable-legacy/ . Red Hat and openSUSE users are redirected from older endpoints (/redhat-stable and /opensuse-stable) to "https://pkg.jenkins.io/rpm-stable/" but are strongly advised to update their "jenkins.repo" repository configurations. System V initialization scripts are removed for openSUSE installations pull 430 (packaging) , Linux install packages migrated from System V init to systemd Move the user time zone configuration to the user preferences page. pull 11065 Remove duplicate built-in executor configuration from System configuration page. It now configures it on the built-in executor under Nodes instead. pull 11224 Add ability to set default value for experimental flags via system property. JENKINS-76260 Redesign the reorderable list component. pull 10186 Log a thread dump when a /health check exceeds the 10 second default timeout to help diagnose stuck requests. This timeout is configurable via the jenkins.health.HealthCheckAction.thresholdTimeout system property. pull 11266 Use the same styling for title bar mouseover effect. JENKINS-75990 Add rest API to create an agent from XML. pull 11229 Add experimental pages for Manage Jenkins, jobs, builds, dashboard, run details, and parameter details. pull 11194 , pull 11208 , pull 11222 , pull 11116 , pull 11127 , pull 11128 Eliminate spurious CPU utilization in browser when idle. pull 11257 Fix toggle collapse in Chrome to prevent 404 errors. JENKINS-76118 Fix MyViewsProperty condition. pull 11252 Set the default enter delay for tooltips to 250ms. JENKINS-75892 Restore file fingerprint and project relationship actions to views. JENKINS-76275 Fix API token rendering. pull 11321 Important security fixes. security advisory Restore Check File Fingerprint and Project Relationship actions to views. pull 11275 Update versionLT and Compare-VersionLessThan to account for Jenkins versioning formatting in `jenkins-support` scripts. pull 2099 (Docker) Update JDK21 from 21.0.8+9 to 21.0.9+10 . pull 2019 (Docker) , Temurin JDK21 release notes Update JDK17 from 17.0.16+8 to 17.0.17+10 . pull 2110 (Docker) , Temurin JDK17 release notes Update Debian Trixie base image version from 20251020 to 20251103 . pull 2188 (Docker) Remove Eclipse modifier class to ensure code compiles as expected. JENKINS-76135 Fix All/None/Suggested buttons visibility in plugin setup wizard. JENKINS-76114 Fix number comparison in min/max form validator. JENKINS-76002 Update Debian container images to Debian 13 (Trixie). pull 2063 (Docker) Updates to various UI elements. Refine the header, app bar, and side panel. Refine colors, borders, and buttons. Use secondary text color for dropdowns. pull 10814 , pull 10806 , pull 10853 , pull 10901 , pull 10913 Breadcrumbs now have a visual indicator and are compatible with accessibility guidelines. JENKINS-75851 Improve performance with additional caching of Java classes. pull 10979 Apply the current theme color palette to shutdown and safe-restart messages. pull 10945 Remove the /extensionList/ HTTP endpoint and related telemetry. Users of the Timestamper plugin should update to version 1.29 or newer. pull 10752 Use a new name format for subdirectories of $JENKINS_HOME/users/ . Stop creating redundant $JENKINS_HOME/users/users.xml . pull 10926 Minor performance optimization for administrative monitors badge display. pull 10855 Refine User page UI. pull 10807 Refine the Console URL Provider UI. pull 10839 Show parameters of a run in read-only mode. pull 10941 Reduce agent launch log stack trace noise for ClosedChannelException s. pull 10927 SSH cli now uses EdDSA natively provided by Apache Mina via Bouncycastle. pull 10788 Add Polish localization. Adjust Bulgarian localization spacing. Add German localization for Global Build Discarder. pull 11025 , pull 10835 , pull 10943 Fix a race condition in WebSocket agent connection initialization. pull 11039 Create friendlier HTTP response for an attempt to buildWithParameters a disabled or nonparameterized job. pull 10954 Fix incorrect parameter name in quietDown API online help. JENKINS-75991 Correct word-wrap and word-break CSS properties to use supported values. pull 10881 Stop printing an incorrect log message when retrieving agent labels. pull 10863 Enable the chevron button in job tables by removing pointerevents:none from its CSS styling. JENKINS-75252 Avoid queue items being lost if the node disconnects at a bad time during allocation. pull 10756 Important security fixes. security advisory Remove link styling in a menu when the corresponding menu is closed. JENKINS-75927 Fix a memory leak in Java class loading for the GStringTemplateEngine class. JENKINS-75879 Reduce plugin ClassLoader memory consumption. JENKINS-75675 Upgrade to Winstone 8.13 and Jetty 12.0.25. Jetty upgrade includes multiple bug fixes and most recent release of Eclipse Jetty 12. pull 10798 , pull 10933 , pull 10958 , JENKINS-76033 , Jetty 12.0.23 changelog , Jetty 12.0.24 changelog , Jetty 12.0.25 changelog , Winstone 8.11 changelog , Winstone 8.12 changelog , Winstone 8.13 changelog Position the Save and Apply buttons for views under the header instead of over it. JENKINS-75937 Restore breadcrumb navigation for the System configuration page. JENKINS-75637 Fix anchor links in Jenkins Taglib documentation. jellydoc-maven-plugin PR 154 , pull 10928 , JENKINS-75931 , stapler-maven-plugin PR 155 Improve UI of secondary actions in the header. JENKINS-75853 Add window listener computeOverflow to trigger a new compute of the breadcrumbs. JENKINS-75818 Prevent multiple dropdowns appearing in breadcrumbs. JENKINS-75834 Display a badge in the hamburger for Actions with active alerts. JENKINS-75832 Make script console layout configurable. JENKINS-75849 Redesign the header and navigation. pull 10245 Display plugin health score in the Plugin Manager. JENKINS-75350 Updates to various UI elements. Refine the appearance of dialogs and Command Palette. Standardize Manage Jenkins page size. Use Jenkins color palette for test results and CodeMirror. pull 10479 , pull 10514 , pull 10687 , pull 10721 Refresh user API Token UI. pull 10484 Remove support for loading user data from releases older than Jenkins 1.283. JENKINS-75370 Remove support for loading proxy configuration from releases older than Jenkins 1.415. JENKINS-75370 Add "No plugins" notice to Appearance configuration page. pull 10478 Update to a dropdown menu display for the user Default View . pull 10482 Improve UI of Secret and Password entry. pull 10489 A new /health endpoint is available to determine whether Jenkins is healthy. JENKINS-75530 New jobs no longer create an empty legacyIds marker file in the builds directory. Existing legacyIds files are deleted upon upgrade to reduce inode usage. JENKINS-75465 Jenkins' own user database no longer accepts new passwords longer than supported by bcrypt (72 bytes). Users with longer passwords are advised to change their password. JENKINS-75533 Remove jbcrypt library. If you use the Active Directory plugin, you must update it to version 2.40 at the same time Jenkins is updated to 2.516.1. JENKINS-75533 Remove deprecated hudson.util.IOException2 . pull 10628 Remove support for ?path and ?pattern query parameters for directory listings of user content, such as workspaces and archived artifacts. The filter text box now uses JavaScript instead of a form submission to navigate to the expected URL. Programmatic users are advised to replace ?path or ?pattern in their requests with the resulting redirect URL, whose behavior did not change from before. JENKINS-75388 Remove PAM Authentication plugin from suggested plugins. pull 10663 Add Powershell script to Windows installer to update registry information after WAR update. Packaging PR 494 Add a "copy to clipboard" button to the Jenkins error page. pull 10712 Complete the Japanese translation for the keepDependencies help file. pull 10366

When running in Jetty (when using the default java -jar jenkins.war ), set the SameSite attribute for cookies to provide additional protection from some CSRF vulnerabilities. By default this sets the attribute to Lax . This can be changed by setting the Java system property jenkins.security.JettySameSiteCookieSetup.sameSiteDefault . Users of Microsoft Entra ID (previously Azure AD) Plugin are advised to update the plugin to version 580.v2f665882b_a_71 or newer at the same time. pull 10630 , Jenkins features controlled by system properties Allow the Views tab bar to be configured per user. pull 10379 Only update affected computers when adding/updating/removing nodes instead of reviewing every computer and checking their retention strategy, which can cause performance issues at scale. JENKINS-33704 Fix limitation of Summary widget on the build page. pull 10368 Fix search result URLs when using the old search implementation. JENKINS-75320 Add value attribute to button element in submit.jelly . JENKINS-75441 Ensure computer configuration is updated correctly after updating a node. JENKINS-33704 Ensure number of executors of the built-in node is synced with the number of executors defined in Jenkins after a configuration reload. pull 10529 Allow icons in tables to be updated even when there is more than one table displayed on the page. pull 10230 Fix "No builds" state remaining in Build History widget after first build. JENKINS-75574 Fix state of labels removed from nodes. JENKINS-68155 When completing a build, look for older builds to rotate asynchronously, in case this process is expensive. pull 10555 Fix the display of icons in the header by only applying the jenkinsavatar class to user icons, not the other header icons. JENKINS-75615 Reduce heap usage of various HTTP endpoints serving large build logs. JENKINS-75081 Restore the children context menu for breadcrumbs. JENKINS-75634 Remove overlapping text from the Thread Dump page. JENKINS-75621 Defer rendering a build's artifact list to a background request to avoid expensive computations. pull 10623 Catch ConnectionRefusalException when thrown by a websocket agent connection attempt. pull 10655 Do not close the dropdown menu when hovering over the submenu of the dropdown menu. JENKINS-75635 Fix URLs in search result list when running at `root` context. pull 10725 Restore side panel actions for views. JENKINS-75683 Replace Loading overlay with skeleton outline on Manage Jenkins pages. JENKINS-68934 Place secondary actions in the collapsing menu instead of displaying them based on screen width. JENKINS-75727 Any RootAction that used custom rendering ( action.jelly ) is once again visible in the header and behaves appropriately. Any RootAction that uses jelly to show/hide is correctly hidden in the header. Any RootAction with sub tasks now shows the subtasks as a dropdown when in the correct context. JENKINS-75683 Upgrade to Winstone 8.10 and Jetty 12.0.22. Jetty upgrade includes multiple bug fixes and most recent release of Eclipse Jetty 12. pull 10720 , JENKINS-75756 , Jetty 12.0.20 changelog , Jetty 12.0.21 changelog , Jetty 12.0.22 changelog , Winstone 8.8 changelog , Winstone 8.9 changelog , Winstone 8.10 changelog Add telemetry to determine whether a specific URL ( /extensionList/ ) is in use by plugins or can safely be removed in future releases of Jenkins. pull 10423 , pull 10505 Only update affected computers when adding/updating/removing nodes instead of reviewing every computer and checking their retention strategy, which can cause performance issues at scale. Ensure number of executors of the built-in node is synced with the number of executors defined in Jenkins after a configuration reload. Ensure computer configuration is updated correctly after updating a node. pull 10494 , pull 10529 , pull 10538 , JENKINS-33704 Upgrade to Winstone 8.7 and Jetty 12.0.19. pull 10451 , Jetty 12.0.18 changelog , Jetty 12.0.19 changelog , Winstone 8.6 changelog , Winstone 8.7 changelog Remove the Yahoo! User Interface library. JENKINS-75100 Add experimental Details widget for builds. pull 10147 Disable the copy button in insecure contexts. JENKINS-74832 Update the Copy button animation. pull 10139 Remove Commons Discovery from the Jenkins WAR. pull 10122 Add the option to display the Console Output on the build page behind an experimental flag. pull 10115 Wrap app bars on smaller screens. pull 10119 Remove the ability to install as a Windows service from a running Jenkins install. Users wanting this functionality should instead download and install the MSI package. pull 8523 Refresh the interface of Jenkins CLI page. pull 10143 Define Jenkins UI colors in a more perceptually uniform way using OKLCH . pull 10078 Improve the appearance of user avatars in Jenkins. Custom avatars are also available through the Avatar plugin . pull 10180 Improve accessibility and clean up various components. pull 10198 Allow the master key to be stored in a separate location. JENKINS-58743 Add space between the Add/Edit description button and Views bar. pull 10386 Add grouping to Command Palette search results. pull 10252 Add empty state to the Manage Old Data page. pull 10320 Add Cancel button to the Edit description form. pull 10364 Update interrupted build action summary icon. pull 10365 Use the correct date in the History widget when a user has configured a dedicated time zone. JENKINS-75163 Form validation for cron schedules included seconds based on the current time, when in fact the trigger fires at minute-granularity slots. pull 10239 Fix occasional failures to write files to Jenkins home directory on Windows servers due to virus scanners. JENKINS-75255 Fix task notification for the rebuild plugin and others. JENKINS-75265 Fix tooltip and console link in the progress bar of jobs in the executors widget. JENKINS-75259 Clarify the displayed message while the build history widget initializes. JENKINS-75321 Fix border radius overlap when multiple lines of view names are displayed. JENKINS-75273 Sort deprecated plugins alphabetically. JENKINS-75341 Prevent dynamic plugin installation from registering the same extension twice in some cases. JENKINS-75232 Fix Manage Jenkins nested context menu to stay open when parent menu closes. JENKINS-72745 Fix enableTopButton to insert entry at the top in an f:repeatable . JENKINS-75464 Prevent Java null pointer exception when adapting a keyboard shortcut based on the User-Agent header. pull 10413 Security fixes. security advisory Clarify the displayed message while the build history widget initializes. JENKINS-75321 Upgrade to Jetty 12.0.17 to fix User pages for users with a \ in their username. pull 10344 , JENKINS-75278 , Jetty 12.0.15 changelog , Jetty 12.0.16 changelog , Jetty 12.0.17 changelog Security fixes. security advisory Use correct date in the History widget when a user has configured a dedicated time zone. JENKINS-75163 Fix notification for `l:task` (regression in 2.481). JENKINS-75265 Fix tooltip and console link in progress bar of jobs in the executors widget (regression in 2.480). JENKINS-75259 Fix occasional failures to write files to the Jenkins home directory on Windows servers due to virus scanners (regression in 2.491). JENKINS-75255 Disable the JnlpSlaveRestarterInstallerTest on ci.jenkins Windows agents. pull 10196 Disable the Yahoo! User Interface library by default. JENKINS-73539 Add Command Palette as a replacement for the search bar. pull 7569 Refine and modernize the appearance of several pages. pull 9734 , pull 9735 , pull 9833 Add icons to Command Palette. pull 10049 Add Turkish translations for node list and RSS links. pull 9928 , pull 9916 Modernize ComboBox component. pull 9462 Show a notification when scheduling a build fails. JENKINS-73813 Clearer error message for the CLI in the default webSocket mode when a 403 error results from a reverse proxy misconfiguration. pull 9930 The agents online/offline status and icon can now be influenced by the offline cause, giving better information to users. Clarifies some use cases when an agent was offline by design and not because of a configuration or technical error. pull 9883 Retain user-generated offline reason when agent connects or disconnects for technical reasons. pull 9855 , JENKINS-30101 , JENKINS-30175 Allow all immutable List subclasses from Java 11 over remoting. pull 10026 Avoid printing the same stack trace multiple times when file persistence fails. Temporary file names used by the AtomicFileWriter are now derived from the target file name. pull 10058 Added password validation to ensure that existing users cannot create a password of less than 14 characters in length when in FIPS mode. JENKINS-74858 Stop allowing configuration of the agent protocols list. pull 9903 Upgrade Winstone to 8.2 in order to update Jetty from 12.0.13 to 12.0.14. pull 9841 , Jetty 12.0.14 changelog , Winstone 8.2 changelog Use refined build status icons in multibranch projects. JENKINS-74868 Form validation that depends on radio buttons now finds the selected one and not the previous one. pull 10081 Since 2.489, JavaScript errors could be seen in some Jenkins pages, such as the setup wizard, omitting the usual header bar. pull 10089 Fix scrolling with keyboard. pull 10054 Reduce spacing in help files. JENKINS-69549 Remove trailing space from Windows agent secret file instructions. JENKINS-72979 Revert update of hotkeys-js dependency introduced in 2.490. The hotkeys-js bump caused a regression with Jenkins plugin BOM tests. pull 10070 Restore the original behavior of FileBoolean(Class, String) . pull 10022 Fix a rare race condition rendering pages soon after startup. pull 9925 Fix end of life operating system monitor that shows 2099-12-31 on the first day a warning should be displayed. JENKINS-73845 Ignore values with incorrect types when deserializing collections and maps in XML files. JENKINS-63343 Upgrade Apache MINA core from 2.0.26 to 2.0.27. JENKINS-75077 Remove Upgrade Automatically from users with `SystemRead` permissions. JENKINS-73908 Fix double-zipped .tgz files so they are no longer mismatched. JENKINS-73942 Allow non-HTTP(S) URLs in zip-based tool installer configuration. JENKINS-75003 Fix exception error message about hudson.model.UpdateSite$Warning on Manage Jenkins that may be shown when plugins with known security issues are installed. JENKINS-73487 Fix double-escaped tooltips in "Help for feature" (regression in 2.380). JENKINS-73907 Important security fix. security advisory Upgrade Script Security plugin to 1368.vb_b_402e3547e7. Script Security 1368.vb_b_402e3547e7 includes a fix for SECURITY-3447 . pull 9970 , JENKINS-74852 , Script Security plugin 1368.vb_b_402e3547e7 release notes Upgrade XStream to 1.4.21. XStream 1.4.21 includes a fix for CVE-2024-47072 . JENKINS-74826 Do not add jobs created via the REST API to the default view (regression in 2.475). JENKINS-74795 Allow context classloaders to be defined without making explicit reference to the calling class. JENKINS-74814 Migrate from http://updates.jenkins-ci.org to https://updates.jenkins.io if the initial installation version was 2.76 or older. JENKINS-73760 Restore compatibility with plugins calling Jenkins#doSafeRestart(StaplerRequest, String) . JENKINS-73838 Restore compatibility with plugins contributing new views with custom XML, such as the Nested Views plugin. JENKINS-73801 Wrap long lines in the build history. JENKINS-73437 Prevent an old version of ASM from appearing as a managed dependency in plugin builds. JENKINS-73867 Update ASM to 9.7.1 to match the most recent release of the ASM API and Jenkins ASM API plugin. JENKINS-73917 Do not allow builds to be deleted while they are still building. Ensure build discarders only process builds which have fully completed. JENKINS-73835 Allow null to be passed as the first argument to doSafeRestart . pull 9882 Wait for ongoing Pipeline builds to fully complete before allowing their parent job to be deleted. JENKINS-73824 Require Java 17 or newer. pull 9358 , JENKINS-67907 , Java 17 requirement blog post Upgrade Spring Framework from 5.3.39 to 6.1.14, upgrade Spring Security from 5.8.14 to 6.3.4, and upgrade Java EE from 8 to 9. Users of the LDAP plugin must upgrade to version 733.vd3700c27b_043 in combination with upgrading Jenkins core. Users of the Reverse Proxy Auth plugin must upgrade to version 1.8.0 in combination with upgrading Jenkins core and must also upgrade the Mailer plugin to version 489.vd4b_25144138f. Users of the CAS plugin must upgrade to version 1.7.0 in combination with upgrading Jenkins core. Users of the Windows Negotiate SSO plugin must upgrade to version 136.vda_2b_6a_744b_d8 in combination with upgrading Jenkins core. Users of third-party servlet containers must upgrade their servlet container to an EE 9 version in accordance with the Jenkins Servlet Container Support Policy. Spring Framework 6.0.23 release notes , Spring Framework 6.1.12 release notes , Spring Framework 6.1.13 release notes , Spring Framework 6.1.14 release notes , Spring Security 6.2.6 release notes , Spring Security 6.3.2 release notes , Spring Security 6.3.3 release notes , Spring Security 6.3.4 release notes , Jakarta EE 9 release page , LDAP plugin 733.vd3700c27b_043 , Reverse Proxy Auth plugin 1.8.0 , Mailer plugin 489.vd4b_25144138f , CAS plugin 1.7.0 , Windows Negotiate SSO plugin 136.vda_2b_6a_744b_d8 , Servlet Container Support Policy , pull 9672 , JENKINS-73278 Upgrade Jetty from 10.0.24 to 12.0.12. pull 9590 , JENKINS-73130 , Jetty 12.0.10 release notes , Jetty 12.0.11 release notes , Jetty 12.0.12 release notes Allow all builds to be removed by the build discarder. JENKINS-68822 Remove Windows path traversal vulnerability escape hatch that was provided with the SECURITY-2481 fix.. pull 9387 , JENKINS-73129 , Path traversal vulnerability on Windows - SECURITY-2481 Fix download of .tar.gz artifacts in Firefox. JENKINS-73381 Enhancements and refinements for the appearance of several pages in Jenkins. pull 9521 , pull 9707 , pull 9461 , pull 9411 , pull 9393 , pull 9381 Refinements and modernizations to sections of the Jenkins UI. pull 9453 , pull 9380 , pull 9365 , pull 9395 , pull 9641 User properties are now categorized in different pages. JENKINS-69869 Update the design of the build history widget. pull 9148 Use Notice component for views lacking jobs. pull 9724 Do not edit unrelated checkboxes in rowSelectionController . JENKINS-73669 Improve display of HTTP handshake errors (such as authentication issues) from the CLI in -webSocket mode. pull 9591 Use webSocket in the inbound agent command line sample. pull 9665 Allow plugins to customize the maximum number of suggestions in autocomplete text fields. pull 9616 Remove obsolete RekeySecretAdminMonitor . JENKINS-73597 Use makeButton to create a jenkins-button on the fly instead of using YUI. JENKINS-73563 Clarify that the plugin incompatibility message applies to the current plugin. JENKINS-73495 Add end of life dates for Alpine 3.20, Ubuntu 24.04, and Fedora 40. Correct several end of life dates, including CentOS 8. pull 9501 Avoid unnecessary download of bundled plugins during the setup wizard. pull 9476 Scroll fields from the added hetero-list entry into the viewport. pull 9488 Modernize the build time trend page with a "time since" column and a link to the console, and allow the table to be resized. Remove the agent column for the Pipeline build trend. pull 9465 When using ExitLifecycle , exit the process immediately upon a boot failure. Also allow custom lifecycles to exit immediately. pull 9483 Display the source URL in logs when installing a plugin. pull 9449 Allow some administrative monitors to be displayed for users with Overall/MANAGE permission. pull 9437 Increase the minimum required Remoting version from 4.13 to 3107.v665000b_51092. pull 9440 Update Stapler from 1880.vb_6d94a_3b_05db_ to 1881.vd39f3ee5c629 and Winstone-Jetty from 6.19 to 6.20 to let Jetty handle HTTP response compression. A new command-line option --compression can be used to disable compression if desired. pull 9379 , Stapler 1881.vd39f3ee5c629 release notes , Winstone-Jetty 6.20 release notes Remove idle executors from the Build Executor widget. pull 9177 The latency for bringing up offline agents can be improved using a new global config option Computer Retention Check Interval and setting an In demand delay of zero on the agents. JENKINS-14789 Several bug fixes for the Jenkins UI. pull 9695 , JENKINS-73695 , pull 9667 , pull 9654 , JENKINS-73330 , pull 9649 , pull 9625 , pull 9658 , JENKINS-73302 Restore compatibility with plugins contributing new objects with context menus, such as the Nested Views plugin. JENKINS-73785 Make deserialization of Map fields in XML files more robust. JENKINS-73687 Restore compatibility with the OpenId Connect Authentication and Reverse Proxy Authentication plugins. pull 9696 Validate display name only against items in the same ItemGroup. JENKINS-72988 Correct the styling for plugins that can't be disabled in plugin manager when user has system read permission. pull 9463 Refresh the build history widget in all cases, including on background tabs or hidden tabs. JENKINS-73613 Fix IndexOutOfBoundsException in cloud management pages when the controller has no executors. pull 9519 , JENKINS-73554 Fix the hudson.slaves.SlaveComputer.allowUnsupportedRemotingVersions escape hatch, which was previously not working with inbound agents. JENKINS-73467